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Abstract 

It has recently been realized that use of the properties 
of quantum mechanics might speed up certain compu- 
tations dramatically. Interest in quantum computation 
has since been growing. One of the main difficulties 
in realizing quantum computation is that decoherence 
tends to destroy the information in a superposition of 
states in a quantum computer, making long compu- 
tations impossible. A further difficulty is that inac- 
curacies in quantum state transformations throughout 
the computation accumulate, rendering long computa- 
tions unreliable. However, these obstacles may not be 
as formidable as originally believed. For any quantum 
computation with t gates, we show how to build a poly- 
nomial size quantum circuit that tolerates 0(1 /log t) 
amounts of inaccuracy and decoherence per gate, for 
some constant c; the previous bound was 0(1 /t). We 
do this by showing that operations can be performed 
on quantum data encoded by quantum error- correcting 
codes without decoding this data. 



1. Introduction 

It has recently been discovered that certain prop- 
erties of quantum mechanics have a profound effect 
on abstract models of computation. More specifically, 
by using the superposition and the interference prin- 
ciples of quantum mechanics, one can devise a physics 
thought experiment giving a computing machine which 
is apparently more powerful than the standard Turing 
machine model of theoretical computer science. Using 
only polynomial resources, these quantum computers 
can compute certain functions which are not known 
to be computable on classical digital computers in less 
than exponential time |J| ^5j. The potentially 
most useful algorithms for quantum computers discov- 



ered so far include prime factorization and simulation 
of certain quantum mechanical systems. 

Given these theoretical results, a natural question 
is whether such computers could ever be built. Inge- 
nious designs for such computers have recently been 
proposed |i~3| , and currently several experiments are 
underway in attempts to build small working proto- 
types |T§[ ] . Even if small quantum computers can suc- 
cessfully be built, scaling these up to computers that 
are large enough to yield useful computations could 
present formidable difficulties. 

One of these difficulties is decoherence (Tsj, 
|li| . Quantum computation involves manipulating the 
quantum states of objects that are in coherent quan- 
tum superpositions. These superpositions, however, 
tend to be quite fragile and decay easily; this decay 
phenomenon is called decoherence. One way of think- 
ing about decoherence is to consider the environment 
to be "measuring" the state of a quantum system by 
interacting with it J3l| . 

A second potential obstacle to building quantum 
computers is inaccuracy |ll| 0, U . Quantum comput- 
ers are fundamentally analog-type devices; that is, the 
state of a quantum superposition depends on certain 
continuous parameters. For example, one of the com- 
mon quantum gates used in quantum computations is 
a "rotation" of a quantum bit by an angle 8. When 
doing this transformation, there will naturally tend to 
be some inaccuracy in this angle 9. For the quantum 
computation to successfully yield the correct result, 
this inaccuracy must be less than the amount of inac- 
curacy which the computation can tolerate. All quan- 
tum gates are potentially analog in that there will be 
some amount of inaccuracy in any physical implemen- 
tation; that is, the output quantum state will not be 
precisely the desired state. What must be shown is 
that the tolerance of the computation to these inaccu- 
racies is large enough to permit quantum gates to be 
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built. 

These two difficulties are closely related. Decoher- 
ence can be expressed purely in terms of inaccuracies 
in the state of the quantum system and an auxiliary 
quantum system interacting with it called the "envi- 
ronment." Thus, decoherence-reduction methods can 
often be used to correct inaccuracy, and vice versa. It 
has already been shown that the use of quantum er- 
ror correcting codes [0], |27], [l5|, Q can reduce both 
decoherence and inaccuracy dramatically during trans- 
mission and storage of quantum data. We build upon 
these techniques to show that the use of these codes 
can also reduce decoherence and inaccuracy while per- 
forming computations on quantum data. 

Until now, the best estimate on the amount of inac- 
curacy required to permit t steps of quantum computa- 
tion was 0(l/t) H . We show in this paper that quan- 
tum circuits can be made substantially more fault- 
tolerant. For any polynomial size quantum circuit, 
we show how to construct a fault-tolerant version of 
the quantum circuit which computes the same func- 
tion and also has polynomial size. This circuit can 
tolerate 0(1/ log c n) inaccuracy in the quantum gates, 
and decoherence averaging 0(l/log c n) per step. 

More specifically, we use the quantum circuit model 
of computation, augmented with measurement opera- 
tions during the computation. For noise-free quantum 
circuits, these measurement operations can always be 
delayed until the end of the computation [^| ; thus pre- 
vious definitions of quantum circuits have sometimes 
only permitted measurement steps at the end, as this 
model is easier to work with and was believed to be 
equivalent. It has not yet been shown that measure- 
ment operations can be delayed until the end of the 
computation for noisy quantum circuits (although this 
seems plausible since noisy quantum gates might be 
used to simulate measurement by noisy classical gates, 
which can in turn perform reliable classical computa- 
tion [^9[ ||^]). For now, it appears to be easier to 
provide fault-tolerance if measurement operations are 
allowed during the computation. There is no funda- 
mental physical reason for requiring that measurement 
be delayed until the end of the computation. 

The techniques used in this paper to build fault- 
tolerant quantum circuits rely heavily on quantum er- 
ror correcting codes O, ^7], [TBI f7|. These codes 
can be used to encode k quantum bits (qubits) of data 
into n qubits of data so as to protect the data if errors 
occur in any t of these n qubits, where n, k and t are 
values which depend on the code used. (But note that 
t cannot exceed some upper bound depending on n and 
k, analogous to upper bounds in classical information 
theory [[ll| [?]].) These codes were previously known to 



be potentially useful for storage and transmission of 
quantum data. It was not clear whether such codes 
could be used to prevent errors during quantum com- 
putation: more specifically, it was not known how to 
compute with encoded qubits without decoding them, 
and decoding the qubits in order to compute exposes 
them to potential errors. Further, decoding or cor- 
recting errors in quantum codes is in itself a quantum 
computation. It was not known how to correct errors 
using noisy quantum gates without possibly introduc- 
ing worse errors. 

Quantum error-correcting codes map qubits into 
blocks of qubits so that a small number of errors in 
the qubits of any block has little or no effect on the 
encoded qubits. We find circuits for correcting errors 
in the encoding qubits and for computing with the en- 
coded qubits so that if these circuits are implemented 
with slightly noisy gates, only a small number of errors 
result in the encoding qubits in each block, and thus 
the encoded qubits are not disturbed. 

This paper shows both how to correct errors in en- 
coded qubits using noisy gates and also how to com- 
pute on these encoded qubits without ever decoding 
the qubits. We can thus alternate steps which per- 
form computations on encoded qubits with steps that 
correct any errors that have occurred during the com- 
putation. If the error probability is small enough and 
the errors are corrected often enough, the probabil- 
ity that we have more errors than our quantum error 
correcting code can deal with remains small. This en- 
sures that we have a high probability of completing our 
computation before it has been derailed by errors. Our 
results thus show that if quantum gates can be made 
only moderately reliable through hardware, substan- 
tial further improvements in reliability may be achiev- 
able through software. 

At this point it may be informative to compare 
the classical and quantum situations with respect to 
computing with noisy gates. Classical storage and 
transmission of data through noisy media can be ac- 
complished with relatively little overhead by using er- 
ror correcting codes. However, performing classical 
computation with noisy gates is considerably harder. 
While ad hoc methods can be used to reduce error in 
classical computers at relatively low cost, general tech- 
niques for performing reliable computation with noisy 
gates require a logarithmic increase in the size of clas- 
sical circuits ^l) . These techniques involve keeping 
several copies of every bit, and periodically reconciling 
them by setting them to the majority value [^9[ |o| ^2| . 

Digital circuitry is reliable enough that these tech- 
niques are only cost-effective when reliability is of 
paramount importance The techniques given in 
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this paper are even more costly in that they require 
a polylogarithmic increase in the size of quantum cir- 
cuits. Quantum gates, however, are inherently less re- 
liable than classical gates and thus in the quantum set- 
ting, the benefit of these techniques may justify their 
cost. 

The techniques in this paper are also related to a 
different classical problem that occurs in cryptography. 
It is possible to perform computation on data that has 
been encoded and shared among several processors so 
that the data known collectively by any small subset 
of the processors gives no information about the un- 
encoded data J8|. This is similar to the quantum me- 
chanical requirement that measurement of the states of 
a small number of qubits in a fault-tolerant quantum 
circuit must give no information about the unencoded 
data, and the techniques used in || are similar to those 
used in this paper. 

The rest of the paper is organized as follows. In 
Section 2, we briefly review the quantum circuit model 
of quantum computation that we use (which also al- 
lows additional measurement steps during the com- 
putation). In Section 3, we briefly review the quan- 
tum error correcting codes discovered independently 
by Calderbank and Shor and by Steane [jll], |2^] , which 
are used in our construction. We also review some of 
the theory of classical error correcting codes. In Sec- 
tion 4, we show how errors in quantum information 
encoded in these quantum error correcting codes can 
be corrected using slightly noisy gates without intro- 
ducing more error than is eliminated. In Sections 5 
and 6, we show how to compute using encoded quan- 
tum data: Section 5 shows how to perform Boolean 
linear operations and certain ir/2 rotations and Sec- 
tion 6 shows how to perform Toffoli gates. Together, 
these form a universal set of gates for quantum com- 
putation. In Section 7, we put all these pieces together 
to obtain robust quantum computation and we discuss 
some open problems. 

Since our submission of this paper, we have learned 
that Zurek and Laflamme have independently inves- 
tigated gates that calculate on encoded qubits [3g] . 
Some of their ideas might be useful for simplifying our 
constructions. 

2. Quantum circuits 

The model of quantum computation we use is the 
quantum circuit model p0| . Our quantum computa- 
tion will be done in the quantum state space of n two- 
state quantum systems (e.g., spin-i particles). Each 
of these two-state quantum systems can be in a super- 
position of two quantum states, which we represent by 



|0) and |1). The quantum state space of n of these 
particles is a 2™-dimcnsional complex space, with 2™ 
basis vectors I&1&2 • • • b n ) indexed by binary strings of 
length n. A (pure) quantum state is simply a unit vec- 
tor in this space. Each of the n particles corresponds 
to one of the n bit positions in the indices of the 2™ 
basis vectors. That is, a quantum state is a sum 

2 „-i 

E a »\ b ) 

6=0 

where the at are complex numbers with ^ b \ctb\ 2 = 1. 
Each of the n particles is called a qubit. 

A quantum gate on k qubits is a 2 k by 2 k unitary 
matrix which acts on the quantum state space of k 
qubits. To apply this transformation to the quantum 
state space of n qubits, we must first decide which k of 
the n qubits we wish to apply it to. We then apply the 
unitary transformation to these coordinate positions, 
leaving the binary values in the other coordinates un- 
touched. For quantum computation, we take k to be 
some constant (such as 2 or 3). Quantum gates on k 
qubits then involve the interaction of only a constant 
number of quantum objects and thus are more likely 
to be physically realizable. It turns out that for con- 
stant k > 2, as long as a reasonably powerful set of 
quantum gates is realizable, the functions computable 
in quantum polynomial time does not depend on k. 
Such a set of quantum gates powerful enough to real- 
ize quantum computation is called a universal set of 
quantum gates; It has been shown that most sets of 
quantum gates are universal || . 

In a measurement operation, we measure the value 
(0 or 1) of one of the qubits. This will project the 
system into a superposition of states where this qubit 
has a definite value of either or 1. If we measure qubit 
i, the qubit will be measured as with probability 

E N 2 ( 2 - 2 ) 

b\bi=0 

and 1 with probability 

E H 2 - ( 2 - 3 ) 

b\bi = l 

If hi is observed to be 0, say, the relative values of the 
coefficients at, are preserved on the states \b) with the 
ith bit of b being 0, but they are renormalized so the 
resulting state is a unit vector. 

A quantum computation is a sequence of quantum 
gates and measurements on this 2 "-dimensional quan- 
tum state space. In order to produce a uniform com- 
plexity class, we need to require that this sequence 
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can be computed by a classical computer in polyno- 
mial time. We allow the classical computer to branch 
depending on the measurement steps; that is, after a 
step which measures bi, different quantum gates can 
be applied depending on whether bi was observed to 
be or 1. 

For our fault-tolerant quantum circuits, we need re- 
sults on universal sets of gates for quantum computa- 
tion. One of the simplest universal sets contains the 
XOR (also called the controlled not) gate and all one- 
qubit gates (j| . The controlled NOT gate, which maps 
basis states as follows: 

|00) - |00) 

|01) - |01) 

1 10) - in) 

|11) - |10), (2.4) 

operates on two qubits and negates the target qubit 
if and only if the control qubit is 1. We say that this 
xors the control qubit into the target qubit. Two 
canonical one-qubit gates are rotations around the x- 
axis by an angle 9, which take 

|0) -► cos(0/2)|O) +sin(0/2)|l) 
|1) -> -sin(0/2)|O)+cos(0/2)|l), 

and rotations around the z-axis by </>, which take 

|0> - |0) 
|1) -> e^ /2 |l). 

We need the result that the following set of three 
gates — rotations around the x-axis and the z-axis by 
7r/2, and Toffoli gates — is a universal set of gates 
sufficient for quantum computation. The proof of this 
involves showing that these gates can be combined to 
produce a set of gates dense in the set of 3-qubit gates. 
Because of space considerations, the details are left out 
of this abstract. 

The Toffoli gate is a three-qubit gate, as follows: 



|000) - 


* |000) 


|001> - 


+ |001) 


|010) - 


+ |010) 


|011) - 


+ |011) 


|100) - 


+ |100) 


1 101) - 


* |101) 


1 110) - 


* 1111) 


1111) - 


* |110), 



The Toffoli gate is a reversible classical gate which is 
universal for classical computation. The XOR is also a 



classical gate, but the only classical functions that can 
be constructed with it are linear Boolean functions; it 
takes three bits to provide a reversible classical gate 
which is universal for classical computation. (Recall 
that all quantum gates must be reversible). We will 
show that fault-tolerant quantum computation is pos- 
sible by showing how to do both tt/2 rotations and 
Toffoli gates fault-tolerantly. 

This paper is too short to fully discuss error models 
in quantum circuits. We work with a simplified error 
model which is easy to analyze. We assume that no er- 
rors occur in quantum "wires" in our circuits, but only 
in the quantum gates. In practice, unless very stable 
quantum states are used to store data, quantum bits 
will degrade somewhat between their output by one 
quantum gate and their input into another. Practical 
large-scale quantum computation thus might require 
storage of quantum data using error correcting codes 
and periodic error correction of the memory in order to 
avoid excess accumulation of errors. For large amounts 
of memory, this may necessitate parallel processing to 
keep the memory from decaying faster than it can be 
accessed. 

For the error model in our quantum gates, we as- 
sume for each gate that with some probability p, the 
gate produces unreliable output, and with probability 
1 — p, the gate works perfectly. This model thus as- 
sumes "fast" errors, which cannot be prevented by the 
quantum watchdog (quantum Zeno) effect Ipjjf . This 
type of error encompasses a standard model for deco- 
herence, where, with some small probability, the state 
of a gate is "measured" during its operation. Fault- 
tolerant circuits which can correct "fast" errors are 
also able to correct "slow" errors. These include the 
standard model of inaccurate gates where the unitary 
matrices the quantum gates implement are not pre- 
cisely those specified. One way to analyze these error 
models is to use density matrices |l|, ||] . 

3. Error-correcting codes 

The construction of quantum error correcting codes 
relies heavily on the properties of classical error cor- 
recting codes. We thus first briefly review certain def- 
initions and properties related to binary linear error 
correcting codes. We only consider vectors and codes 
over F2, the field of two elements, so we have 1 + 1 = 0. 
A binary vector v € F2 with d l's is said to have Ham- 
ming weight d. The Hamming distance dii{v, w) be- 
tween two binary vectors v and w is the Hamming 
weight of (v + w). 

A code C of length n is a set of binary vectors of 
length n, called codewords. In a linear code the code- 
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words are those vectors in a subspace of F£ (the n- 
dimcnsional vector space over the field F2 on two ele- 
ments). The minimum distance d = d(C) of a binary 
code C is the minimum distance between two distinct 
codewords. If C is linear then this minimum distance 
is just the minimum Hamming weight of a nonzero 
codeword. 

A linear code C with length n, dimension k and min- 
imum weight d is called an [n, k, d] code. A generator 
matrix G for a code C is an n by k matrix whose row 
space consists of the codewords of C. A parity check 
matrix H for this code is an n by n — k matrix such 
that Hx T = for any x in the code. In other words, 
the row space of H is the subspace of F2 perpendicular 
to C. 

For a code C with minimum weight d, any binary 
vector in F£ is within Hamming distance t — L^j^J 
of at most one codeword; thus, a code with minimum 
weight d can correct t errors made in the bits of a 
codeword; such a code is thus said to be a t error 
correcting code. Suppose we know a vector y which is 
a codeword with t or fewer errors. All the information 
needed to correct y is contained in the syndrome vector 
s = Hy T . If the syndrome is 0, we know y 6 C. 
Otherwise, we can deduce the positions of the errors 
from the syndrome. To correct the errors, we need 
then only apply a NOT to the bits in error. Computing 
the positions of the errors from the syndrome is in 
general a hard problem; however, for many codes it 
can be done in polynomial time. 

The dual code of a code C is the set of vectors 
perpendicular to all codewords, that is C 1 - = {v e 
F™ : v ■ c = Vc e C}. It follows that if G and H 
are generator and parity check matrices of a code C, 
respectively, then H and G are generator and parity 
check matrices for C . 

Suppose we have an [n, k, d] linear code C such that 



C x cCc R 



(3.1) 



We can use C to generate a quantum error correcting 
code which will correct errors in any t — (d — l)/2 or 
fewer qubits. More details and proofs of the properties 
of these codes can be found in ; in this abstract 

we only briefly describe results shown in these papers. 

We will be using two different expressions for the 
codewords of our quantum codes. The first is described 
in p7| . Suppose that v € C. We obtain a quantum 
state on n qubits as follows: 



\s v ) = 2-(- fe )/ 2 £ \v + w) 

w£C J 



(3.2) 



\s v ) = \s u ) if and only if u + v € C . Thus, there are 
dim C — dim C ^ = 2k — n codewords in our quantum 
code. 

By rotating each of the n qubits in a quantum code- 
word as follows: 

10} - 7f(|0> + |l» 

|1> - 7f(|0>-|l», (3-3) 

it is easy to verify that we obtain the quantum state 

M = 2- fc /2 (3.4) 

As with the s-basis, it is easily checked that \c v ) — \c u ) 
if and only if u + v 6 C . Wc call this the c-basis for 
our code; it was first described in jyj. 

In quantum codes, in order to correct t arbitrary 
errors, all that is needed is be able to correct any t 
errors of the following three types j?], |l5| : 



1) bit errors, where |0) 
qubit, 



II) and II) 



for some 



2) phase errors, where |0) — * |0) and |1) — * — 11) for 
some qubit, 

3) bit-phase errors, where |0) — > |1) and |1) — * — 10) 
for some qubit. 

Phase errors can be converted to bit errors and vice 



versa by applying the change of basis in Equation (3.3) 



We refer to this as the s-basis, and will be using it in 
most of our calculations. It can easily be shown that 



Note that in both the s- and the c-bases, the codewords 
are superpositions of codewords in our error correcting 
code C. Thus, to correct errors in the above quantum 
error correcting code, we can first correct bit errors in 
the s-basis using cl assi cal error correcting techniques, 
change bases as in (3.3), and then correct phase errors 
in the s-basis (which have become bit errors in the 
c-basis) by using the same classical error correcting 
code techniques. It remains only to show that these 
two correction steps do not interfere with each other; 
this is done in detail in 

4. Correcting errors fault-tolerantly 

To correct errors in quantum codes, we first correct 
errors in the codewords seen in the |s) basis ; we next 
rotate each qubit of the code as in Equation (|3.3|) (this 
could be done symbolically); and finally we correct 
the errors in the \c) basis. In either basis, the error 
correction can be done by determining which bits are 
in error by first computing the (classical) syndrome 
and then applying a NOT operation (in the appropriate 
basis) to those bits which are in error. The hard part 
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of this procedure turns out to be the determination of 
which bits arc in error. 

Recall that to determine which bits are in error 
in classical codes, we need to compute the syndrome 
S = Hx T , where x is the word we are trying to decode. 
This procedure will work equally well for our quantum 
codes, although in this case it must be done separately 
for the bit and the phase errors. It is this step which is 
hard to do fault-tolerantly. Computing the error from 
the syndrome is hard for arbitrary linear codes, but 
if we have made a good choice of our classical code C, 
then we have a polynomial-time algorithm for comput- 
ing the error from the syndrome. Note that since we 
can measure the syndrome, this decoding step can be 
done on a classical computer. We discuss later in Sec- 
tion 7 classical codes which are both polynomial-time 
decodable and also strong enough to use to construct 
fault-tolerant quantum circuits. 

The obvious way to measure the syndrome would 
be the following. For each row of the parity check ma- 
trix H, we take an ancillary qubit (or ancilla) which 
starts in the state |0), perform a controlled not from 
each of the qubits corresponding to l's in that row of 
the parity check matrix into the ancillary qubit, and 
finally measure this ancillary qubit. Assuming that we 
do not make any errors in our quantum calculations, 
this works perfectly. Unfortunately, this method is not 
robust against quantum errors. One possible quantum 
error is a measurement error, where the qubit is mea- 
sured as |0) instead of |1) or vice versa. If this were 
the only kind of error possible, it could be controlled 
by repeating the measurement several times. Unfortu- 
nately, this method also permits much worse types of 
error. 

Suppose that we apply the above method, and 
halfway through the process (i.e., when we have xORed 
half of the l's in that row of the parity check matrix 
H into our ancillary qubit), the state of the ancilla 
changes spontaneously. We now quite possibly obtain 
a wrong value for that bit of the syndrome, but much 
worse, we have also changed the state of the quantum 
codeword. This can most easily be seen by changing 
the basis for all the qubits in the codeword, as well as 
for our ancilla, by Equation ( |3.3| ). The effect of this 
change of basis on an controlled not is to reverse the 
roles of the control and the target qubits. Thus, in 
the rotated basis, our computation xors the ancillary 
qubit (|0) + \l})/^/2 into certain qubits of our code- 
word. If everything proceeds without error, this mea- 
surement changes the state of our quantum codeword 
byxORing |000 . . . 00) + 1 111 . . . 11) into the qubits cor- 
responding to l's in some row of the parity check ma- 
trix H. Since H is a generator matrix for the dual code 



C , it follows after some calculation that this does not 
change our codeword. However, if the state of the an- 
cillary qubit changes in the middle of our computation, 
we could end up xORing |000 ... 11) + 1 1 1 1 ... 00) into 
our quantum codeword. In this scenario, one error 
during the quantum error correction would possibly 
lead to more errors in our quantum codeword than it 
is possible to correct. This technique thus cannot be 
used for error correction in quantum computation. 

We use a slightly different technique to measure the 
syndrome without introducing too many errors in our 
quantum codewords. To measure the ith bit of the 
syndrome, we first construct a "cat state" 



l 

73 



(|000...0) 



1111 



•1)) 



(4.1) 



where the number of qubits in this state (say I) is 
equal to the number of l's in the ith row of our par- 
ity check matrix H . (This is called a "cat state" af- 
ter Schrodinger's renowned cat, as it is the one of the 
most unstable states of I qubits.) We next verify the 
cat state by measuring the XOR of random pairs of its 
qubits (this can be done using an auxiliary qubit). If 
all these measurements are 0, this will ensure that the 
cat state is a superpositions of states containing nearly 
all 0's or nearly all l's, although the relative phase of 
the all-0's and the all-l's states may still be in error. 
If these measurements are not all 0's, we construct an- 
other cat state and repeat the process. 

To use the cat state, we next ro tate each qubit of 
the cat state as in transformation (3.3). If we do not 
make any errors, this gives a state 



2 -(J-i)/a J- \b) 



(4.2) 



6:6-1=0 



where I is the number of qubits in our cat state and 1 
is the length I all-ones vector. In other words, this is 
the superposition of all states with an even number of 
l's. Finally, we XOR each of the qubits of the ith row 
of the parity check matrix into one of the qubits of the 
rotated cat state. Since this rotated cat state was in 
the superposition of all even-parity states, if we now 
measure the qubits in this state, the parity of number 
of l's observed will be the ith bit of the syndrome. 
More important, even if we have made r errors in our 
calculation, the back action of the XORs on the encoded 
state will not introduce more than r errors in qubits 
of our codeword. Thus, we can measure bits of the 
syndrome and keep our encoded states well protected. 
This allows us to correct errors while introducing on 
the average fewer errors than we correct. 

Measurement of the syndrome using the method 
above is not guaranteed to give the right answer. What 
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it does guarantee is that errors in the measurement op- 
eration are unlikely to produce catastrophic back ac- 
tion which destroys the encoded state beyond repair. 
We still need to ensure somehow that we obtain the 
right value for the error syndrome before attempting 
to correct the errors. One way to get the right er- 
ror syndrome with probability 1 — 1/t is to repeat the 
above measurement 0(\ogt) times. If we obtain the 
same error syndrome each time, the probability that 
we have made the same error repeatedly is very small. 
If we obtain different syndromes, we can keep repeat- 
ing the measurement until the same error syndrome 
is obtained 0(\ogt) times in a row. If the error rate 
is set low enough this guarantees that we correct the 
error with probability at least 1 — 1/t, 

5. XOR Gates and 2 Rotations 

In order to give our construction for fault-tolerant 
quantum circuits in detail, we first need to introduce 
more facts about error correcting codes. These can 
be found explained in more detail in coding theory 
books (such as [0). We will be using codes with 
dim(C) — dim(C' L ) = 1; they are thus rather ineffi- 
cient in that they code one qubit into n. The codes 
we use can be constructed from self-dual codes with 
C = C 1 - by deleting any one coordinate; such codes are 
called punctured self-dual codes. If a code C has min- 
imum distance d, the punctured code has minimum 
distance at least d — 1 and can thus correct [d/2 — lj 
errors. Binary self-dual codes have the property that 
all codewords have an even number of ones, since every 
codeword must be perpendicular to itself. Some bi- 
nary self-dual codes have the additional property that 
the number of ones in all codewords is divisible by 4. 
These are called doubly even codes and their proper- 
ties are useful in constructing fault-tolerant quantum 
circuits. 

Suppose that we have a punctured self-dual code 
C with length n, dimension k = (n + l)/2 and min- 
imum distance d. Consider the corresponding quan- 
tum codewords \s v ). From the previous section, we 
have that the number of different quantum codewords 
is 2k — n = 1. It is easy to verify that one of these con- 
sists of the superposition of all codewords in C with 
even weight (these are the codewords of C^) and the 
other consists of the superposition of all codewords of 
C of odd weight. We label these |so) and \s\) respec- 
tively. It is also easy to see that the c-basis of our code 
looks like: 



V2 
1 
V2 



(l*o) 
(\so) 



\si))- 



Recall that we get from the s-basis to the c-basis 
of our quantum codes by applying the transformation 
(3.3) to each qubit of our codewords. It is clear from 
the above equations that applying this transformation 
to each qubit individually also applies this transforma- 
tion to the encoded states. Further, this transforma- 
tion is fault-tolerant. Suppose that there were at most 
r errors in qubits of the input state. This transforma- 
tion is applied separately to each qubit, so the output 
state will also contain r errors in it if the transforma- 
tion was applied perfectly. Even if the transformation 
is imperfect, an error in one application of a quantum 
gate can only affect one qubit since the transforma- 
tion is applied bitwise, so even with noisy gates, this 
transformation can introduce only a small number of 
errors, 

A number of other transformations of the encoded 
qubits can also be performed by applying them bitwise 
to the codeword. We demonstrate this with an XOR 
gate. Suppose we have two different qubits encoded, 
\s a ) and \sb). Expanding these, we have the quantum 
state 



\Sb. 



= 2 -(n-k) 



w£C J 



E 



\w' + b) (5.2) 



Applying an XOR from the ith qubit of the first code- 
word into the ith qubit of the second codeword, we 
obtain 

2-ln-k) (\w + a) \w' + b + w + a)). (5.3) 



w£C J 



If w' ranges over all codewords in C , then for any fixed 
w G C , w' + w also ranges over all codewords in C . 
Thus, the above sum can be rewritten as \s a )\s a +b) ■ 
This oper atio n works for any C with C C C as in 
Equation (3T). For punctured self-dual codes C, with 
dimC^ = dimC — 1, this gives an XOR gate. 

Other operations which can also be done bitwise are 
the phase change operation |s a )|sb) — * (— l) a ' fc |s a )|sf>) 
and (for punctured doubly even self-dual codes), the 
rotation 



zlsi) 



(5.4) 



(5.1) 



The calculations for both of these cases are straight- 
forward. 

These above operations which can be done bitwise 
are not enough to provide a universal set of gates for 
quantum computation. They only generate unitary 
matrices in the Clifford group, which is a finite group 
of unitary transformations in 2 n -dimensional complex 
space that arises in several areas of mathematics Jul . 
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The transformations in this group corresponding to 
classical computation are the linear Boolean transfor- 
mations, which can be built out of XOR and not gates. 
To obtain a set of gates universal for quantum compu- 
tation, we add the Toffoli gates as in Equation (2.5). 
This construction is discussed in the next section. 

6. Toffoli gates 

We construct our Toffoli gate in two stages. We 
first show how to construct a fault-tolerant Toffoli gate 
given a set of ancillary quantum bits known to be in 
the encoded state ^(|soSoSo) + |so s i s o) + |siso s o) + 
IsiSiSi)). This procedure is done using only linear 
Boolean operations and tt/2 rotations on the encoded 
qubits. We next show how to fault-tolerantly put a set 
of ancillary qubits into the above state. This operation 
will be somewhat harder, as it cannot be done using 
operations in the Clifford group. To construct this 
state, we use a "cat" state (|000 ... 0) + 1 111 . ..l»/\/2 
as we did in Section 4. 

A technique used both in this section and in Sec- 
tion 4 is that of first constructing an ancillary set of 
qubits known to be in a certain state and then using 
them to perform operations on another set of qubits. 
This is reminiscent of techniques used in several quan- 
tum communication papers. In quantum teleportation 
|5] , if two researchers share an EPR pair, they can use 
this pair and classical communication to "teleport" 
the quantum state of a particle from one researcher 
to another. In Q, a small number of "USD A" pairs 
of qubits known to be in perfect EPR states can used 
to purify a set of noisy EPR states, sacrificing some of 
them but yielding a large set of good EPR pairs. This 
paradigm may prove useful in other quantum compu- 
tations. 

6.1 Using the ancillary state 

Suppose we had an ancillary set of qubits known to 
be in the encoded state 



1 



Isosiso) 



|siSqs ; 



\-SlS 1 S 1 )). 

(6.1) 

We now show how to use these to make a Toffoli gate 
on 3 other encoded qubits, using Boolean linear oper- 
ations and 7r/2 rotations. Recall that the Toffoli gate 
transforms qubits by negating the third qubit if and 
only if the first two are l's. We first build a gate 
that makes the following transformation taking two 
encoded qubits to three encoded qubits. 



|S0Sl) 

|sis ) 
IsiSi) 



|siSo«o) 

IsiSiSi) 



(6.2) 



Note that this gate adds a third (encoded) qubit, which 
is a 1 if and only if the first two are both l's, and which 
is otherwise. This gate uses the ancillary state \A) 
described above, as well as linear operations, which 
can be performed robustly as in Section 5. 

To perform these transformations, we first append 
the ancilla \A) to the first two qubits. We next XOR 
the third qubit into the first, and the fourth qubit into 
the second. This produces the transformation 



\s s )\A) 
\s si)\A) 
\sis )\A) 
M\A) 



2 \ \SoSoSoSoSo) 

+ |siSosisoSo 
!( |soSis s so) 

+ |siSiSiS So 

!( |sis sos so) 

+ |s S SiSoSo 



s s 1 s s 1 s ) 

\siSlSlSlSl) ) 

sosososiso) 

|siS SiSiSi) ) 
SiSiSqSiSq) 
\s Q SiSiSiSi) ) 

siSis q s sq) + |sis soSiSo) 

|soSlSlS So) + IsoSoSlSlSl) ) ■ 

(6.3) 



Finally, we measure the first and second encoded 
qubits. 

Suppose we measure them to be |soSo), so both en- 
coded qubits are 0. Focusing on the elements of the su- 
perposition where the first and second encoded qubits 
are both 0, we get the transformation given by (S.2), 
which is what we wanted in the first place. Suppose, 
however, that we measure the first and second encoded 
qubits to be in the state |so s i)- Pulling out the rele- 
vant elements of the superposition, we get 



\soSo) 
\soSi) 
\sis ) 
\sisi) 



\SoSiSq) 

\sqSqs } 

\siSiSi) 

\sis s ) 



(6.4) 



This transformation can be converted to the one we 
want by first applying a controlled NOT from the first 
qubit to the third qubit, and then applying a not to 
the second qubit. These are both Boolean linear oper- 
ations and so can be applied fault-tolerantly. Putting 
these transformations together, we get 



\SoSo) 



soSq) - 


-> Isosiso/ - 


-> |soSis / - 


-> |s s so 


sqSi) - 


so^oso) - 


sososo) - 


-> s siSo 


Sl8 ) - 


-> SlSlSl) - 


-> SlSlSo) - 


-> SlS S 


SlSl) - 


-> siSqSq) - 


-> SiSqSi) - 


-» \sis 1 s 1 



(6.5) 
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It is easy to check that the other two cases (where we 
observe |siSq) or |sisi)), can also be corrected to the 
desired gate by linear operations. Thus, by observing 
two of these five qubits and applying linear operations, 
we have achieved what is nearly a Toffoli gate. 

We still need to show how to get the complete Tof- 
foli gate on three qubits, as in Equation ([2~5|). To do 
this, we start with three qubits to which we want to ap- 
ply the Toffoli gate, and apply transformation ( |6.2| ) to 
the first two. We next apply a controlled not from our 
original third qubit (represented in fourth place below) 
to the newly introduced qubit (represented in third 
place below). We finally apply |s ) — > (|so) + l s i))/V2> 
\si) — > (|so) — |si))/v2 to the original third qubit (rep- 
resented in fourth place below). This gives the trans- 
formation: 



sososo) - 


1 

V2 


S0S0S0) 


(|so) 


+ |si) 


sosiso) - 


1 

V2 


S SiS ) 


(|so) 


+ |si) 


SiSqSq) - 


1 

V2 


SiSqSq) 


(|so) 


+ |si) 


Si Si So) - 


1 

V2 


S1S1S1) 


(|so) 


+ |si) 


S S Si) - 


1 

V2 


S S Si) 


(|so) 


- |si) 


SoSlSi) - 


1 

V2 


SoSlSi) 


(|so) 


- |si) 


SiSqSi) - 


1 

V2 


SlS Sl) 


(|so) 


-|si) 


818181) - 


1 

V2 


Si Si So) 


(|so) 


-|si) 



(6.6) 



We now observe the fourth qubit in the expression 
above. If we observe \so), it is easy to see that we 
have performed a Toffoli gate. If we observe |si), we 
need to fix the resulting state up. This can be done 
by applying the transformation 



|s„s 6 s c ) (-l) a - b (-l) c |s a s fe s c ) 



(6.7) 



to the three remaining encoded qubits (recall that 
we measured the last qubit). This is the composi- 
tion of the two linear operations \s a Sb) — > (— l) a b and 
|s c ) — > (— l) c , so it can be done fault-tolerantly using 
the methods of Section 5. 

6.2 Constructing the ancillary state 

For the last piece of our algorithm, we need to 
show how to construct the ancillary state |(|soSo s o) + 
|so s i s o) + |sis So) + |siSiSi)) fault-tolerantly. To ob- 
tain this, we use the technique we used in Section 4 of 
introducing a "cat" state (|000 . . . 0) + | 111 . . . l))/\/2, 
which we can check to ensure that it is in a state close 
to the desired state before we use it. We use two states 



state \B), which are as follows: 

\A) = ^(\s s s ) + \s Q sis ) + \s 1 s s a ) + |sisisi)) 
l-B) = ^(Isososi) + |s sisi) + |sis si) + |sisis )) . 

Note that \A) is the state we want, and \B) is easily 
convertible to it by applying a not operation to the 
third encoded qubit. Note also that 

75(I^> + I B » = ^(|so)+|si))(|so)+|si»(|s )+|si» , 



(6.8) 

which is easily constructible through operations dis- 
cussed in Section 5. Let us now introduce some more 
notation: let |0) = |000 . . . 0) and |1) = | 111 ... 1) , 
where these states are both on n qubits. Thus, 
(|0) + |l))/-\/2 is the cat state described above. Sup- 
pose we could apply a transformation that changed 
states as follows: 



|0M 
|o)|s) 

\D\B) 



|0)|A) 
V)\A) 
|0)|B> 
M)\B). 



(6.9) 



We would then be able to construct state \A) as fol- 
lows. First, construct 



K|0) + |1))(L4) + |i?)), 



(6.10) 



where the cat state has been verified as in Section 4 
to make sure it is close to the desired cat state (i.e., 
nearly all the probability amplitude is concentrated in 
states with either nearly all 0's or nearly all l's). We 
next apply the transformation (|6.9[) to obtain the state 



|(|0> 



|1))L4) + ±(|0)-|1»|5> 



(6.11) 



Finally, we observe whether the "cat qubits" are in the 
state |0) ± |1). This tells us whether the unobserved 
qubits contain \A) or \B). 

The probability of being in state \A) can be es- 
timated using the probabilities of error during the 
quantum calculation. If this probability is not high 
enough, we repeat this step, applying the transforma- 



tion (6.9) not to the state (6.10) but to the output state 



on 3n qubits, the state \A) defined in (6.1) and the 



from the previous step along with a newly constructed 
"cat state." Repeating this step logarithmically many 
times can be shown to increase this probability of be- 
ing in state \A) to polynomially c lose to 1. 

To apply the transformation (3.9) to a superposi- 
tion |a)|sfe)|s c )|sd), it is sufficient to apply bitwise the 
operation 

|o<)|6i>|ci)l*> -> (-ir^ c * +t ^ {aJMciM) (6.12) 
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to the zth qubit of \a), \sb), \s c ) and \sd) for 1 < i < n. 
This operation is easily accomplished by elementary 
quantum gates and as it is a bitwise operation, it is 
fault-tolerant. 

The one piece of the computation which we have 
not yet described is how to construct an encoded state 
|so). This can be done by techniques similar to those 
described in this paper, but there is no space to de- 
scribe this in detail. 

7. Conclusions 

We now estimate the accuracy required to make 
quantum circuits fault-tolerant with these methods. 
The only large binary self-dual codes I know of 
which are also decodable in polynomial time are 
the [2™+ 1 ,2 m ,2 m / 2 ] self-dual Reed-Muller codes 
These codes arc indeed doubly even, but unfortunately 
their minimum distance (and error correction capac- 
ity) grows as the square root of their length n. This 
will be enough for our purposes, but these codes are 
substantially worse than both the theoretical maxi- 
mum and than the known constructions without all 
the required properties. 

In order to do s steps of quantum computation 
with a low probability of failure, we need a quantum 
code which can correct O(logs) errors. Using Reed- 
Muller codes, this means we need codewords of length 
0(log 2 s). In measuring the syndrome, to be relatively 
sure that we have not made an error in computing it, 
we measure each bit of the syndrome O(logs) times 
(this is probably overkill). Using the measuring tech- 
nique described in Section 4, even if we make errors 
while measuring the syndrome, we do not substantially 
affect our encoded qubits. 

Computing the error syndrome requires a num- 
ber of quantum gates proportional to the number of 
l's in the parity check matrix, which in this case is 
0(log 3 s). Since we measure the syndrome O(logs) 
times in our correction step, the entire correction step 
takes 0(log 4 s) operations. We need to set the error 
rate low enough so that there will be less than one error 
on the average throughout this process, which means 
we must have error rate less than 0(1/ log s) per gate 
operation. Computation operations on encoded qubits 
take at most 0(log 4 s) steps, so these can also be ac- 
complished while ensuring that there is a very small 
probability of making more errors than we can correct. 

One additional result which would be nice is the 
discovery of better binary self-dual error correcting 
codes which are also efficiently decodable; this could 
substantially increase the asymptotic efficiency of the 
fault-tolerant quantum circuits described in this pa- 



per. Another interesting result would be a method for 
performing rotations on encoded bits directly, rather 
than going through Toffoli gates. This could be accom- 
plished using techniques similar to those in Section 6 
if the ancillary state cos(6')|so) +sin(6')|s 1 ) could be 
constructed fault-tolerantly for arbitrary 0. 

The techniques in this paper pay a moderate 
penalty in both space and time for making quantum 
circuits fault-tolerant. An interesting question is how 
much time and space are really required. The space, 
for example, could likely be reduced significantly by us- 
ing more efficient quantum error correcting codes for 
memory Another interesting question is how much 
noise in quantum gates can be tolerated while still 
permitting quantum computation. A lower bound on 
this quantity is shown in jlj. Better error-correcting 
codes could possibly increase the maximum allowed er- 
ror rate considerably from 0(1/ log 4 t), but it appears 
that to get results better than 0(1/ log t), substan- 
tially different techniques may be required. 

Finally, the analysis in this paper is purely asymp- 
totic. An analysis needs to be done to see how much 
fault-tolerance these techniques provide for quantum 
computations using specific numbers of gates, and at 
what cost in space and time this could be accom- 
plished. 
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